Privacy policy

Last updated 5 September 2026

This explains what I do with your information when you enquire about my services or become a client. It's written in plain English on purpose — if anything here isn't clear, email me and I'll explain it.

Who I am

Heys Digital is a trading name of Joe Heys. I build websites, set up Google Business Profiles, manage reviews and produce social media content for small businesses in the UK. For the purposes of UK data protection law I am the "data controller" for the information described below.

What I collect, and why

When you enquire

If you fill in the form on my site I collect your name, what you do, your town, your phone number, and anything you choose to put in the message box. If you contact me on WhatsApp or by email, I hold whatever you send me — including your phone number or email address.

I use this to reply to you, to price the job and to put together the mockup I offered. I don't sell it, I don't add you to a mailing list, and nobody else gets it.

When you become a client

I hold the details I need to do the work and to get paid: your business details, the content and photos you send me for your site, your contact details, and records of what I've invoiced you.

Your customers' information

If you're on a plan where I handle reviews, I may see the names and comments your customers have left publicly on your Google Business Profile, and — where you ask me to send review requests — the contact details you pass to me for that purpose. That information stays yours: I act on your instructions, I only use it to do the job you've asked for, and I delete my copy when you stop working with me.

My lawful basis

Who else sees it

I use a small number of suppliers to run the business. They only get what they need to provide their service to me, and they aren't allowed to use it for anything else.

• Formspree — delivers my enquiry form to my inbox. Formspree is based in the United States, so form submissions are transferred there under the safeguards UK law requires.
• My email and WhatsApp providers — because that's where your messages arrive.
• My website host — which keeps standard server logs, including visitors' IP addresses, for security.
• Google — my pages load fonts from Google's servers, which means Google receives your IP address when you visit. If you're a client, I also work inside Google Business Profile on your behalf.

I'll also disclose information if the law requires it. Beyond that, no one else gets it.

How long I keep it

• Enquiries that don't go anywhere: 12 months, then deleted.
• Client records: for as long as we work together, and 12 months afterwards.
• Invoices and accounting records: 6 years, because HMRC requires it.
• Anything you ask me to delete sooner: deleted, unless I'm legally required to keep it.

Cookies

This website doesn't set any cookies of its own, doesn't track you across other sites, and doesn't run advertising. As noted above, loading my fonts means a request goes to Google's servers, which reveals your IP address to them — that's standard for most websites, but you're entitled to know it happens.

Your rights

Under UK data protection law you can ask me to:

• Tell you what I hold about you, and give you a copy
• Correct anything that's wrong
• Delete it
• Stop or limit what I'm doing with it, including objecting to it entirely
• Send it to you, or to someone else, in a portable format

Email [email protected] and I'll deal with it within one month. It costs you nothing.

Changes to this policy

If I change how I handle your information I'll update this page and change the date at the top.